Everyone who needs to work in PocketPass should have their own login. Shared accounts make it impossible to tell who changed what, and awkward when someone leaves.
Manage this under Settings → Team.
Adding someone
- Open Settings → Team.
- Enter their email address.
- Choose a role.
- Add them.
They must already have a PocketPass login before you can add them. If you get told there's no user with that email, ask them to sign up first with that exact address, then add them.
The roles
Admin can do everything: create and edit templates, issue and edit passes, send notifications, manage API keys and webhooks, and manage the team - including adding and removing other admins.
Viewer can see everything but change nothing. They can browse passes, templates and notification reports, but can't issue, edit, send or configure.
Choosing a role
Give admin to the people who run the programme day to day - whoever designs templates, issues passes and sends messages.
Give viewer to people who need visibility without responsibility: someone on a support desk who needs to look up a customer's pass, a manager who wants to see how campaigns performed, an agency you're working with.
When in doubt, start someone as a viewer. It's a two-second change to promote them once they've found their feet, and it avoids a new person discovering the bulk-archive button before they know what it does.
Changing someone's role
Pick a new role from the dropdown on their row and save.
You can't demote the last admin. Every account needs at least one, otherwise nobody could ever change anything again - including the setting that got you into that state. Promote someone else first, then change your own role.
Removing someone
Choose Remove on their row and confirm. They lose access immediately.
The same last-admin protection applies - you can't remove the only admin.
Removing someone doesn't delete their PocketPass login, and it doesn't touch anything they created. Templates, passes and campaigns belong to the account, not to the person who made them.
Removing a teammate does not revoke API keys. Keys belong to the account and keep working. If the person who left had access to a key, revoke it separately under API keys and issue a replacement. See API keys and authentication.
When someone leaves
A short checklist:
- Remove them from the team.
- Revoke any API keys they had access to, and create replacements for whatever was using them.
- Check your webhook endpoints - if any point at a system only they could reach, update or remove them.